CVE-2020-2283: 
Java vulnerability analysis and mitigation

Jenkins Liquibase Runner Plugin version 1.4.5 and earlier contains a stored cross-site scripting (XSS) vulnerability identified as CVE-2020-2283. The vulnerability was discovered and disclosed on September 23, 2020, affecting the plugin's handling of changeset contents when displaying them on the build page (Jenkins Advisory, OSS Security).

The vulnerability stems from the plugin's failure to properly escape changeset contents when displaying them on the build page. This creates a stored XSS condition that can be exploited by attackers who have the ability to provide Liquibase changesets that are evaluated by the plugin. The severity of this vulnerability is rated as High according to the CVSS scoring system (Jenkins Advisory).

The vulnerability allows attackers with the ability to provide Liquibase changesets to execute stored cross-site scripting attacks through the Jenkins build page. This could potentially lead to unauthorized access to sensitive information or execution of malicious code in the context of other users' browsers (Jenkins Advisory).

The vulnerability is exploitable by attackers who have the ability to provide Liquibase changesets that are evaluated by the plugin. The stored XSS payload can be triggered when these changesets are displayed on the build page (Jenkins Advisory).

The vulnerability was fixed in Liquibase Runner Plugin version 1.4.7, which completely removes support for evaluating changesets. Users are strongly advised to upgrade to this version or later to address the security issue (Jenkins Advisory).

The vulnerability was discovered and reported by Daniel Beck from CloudBees, Inc., who was credited in the Jenkins security advisory (Jenkins Advisory).